What Is It?
VPN Gateway is a fully managed service that creates secure, encrypted site-to-site connections between your on-premises network (or other remote sites) and one or more IONOS Virtual Data Centers (VDCs). It supports the industry-standard IPSec (IKEv2) and WireGuard protocols, allowing you to choose the approach that best fits your security and performance requirements. Data is encrypted in transit using strong ciphers, and the service provides optional high-availability with automatic fail-over to minimize downtime.
Quick Facts
| Aspect | Details |
|---|---|
| Protocols | IPSec (IKEv2, PSK authentication) or WireGuard (key-pair authentication) |
| Encryption | AES-256 (IPSec), ChaCha20 (WireGuard), SHA-256/384/512 hashing |
| Throughput | Up to 1 Gbps per tunnel |
| Routing | Static routing only (no BGP) |
| IP Support | IPv4 tunnel endpoints; gateway supports IPv4 and IPv6 traffic (dual-stack) |
| Redundancy | Optional High Availability (active-passive) for automatic fail-over |
Tier Specifications
| Tier | Max LANs | Max Tunnels/Peers | High Availability | Use Case |
|---|---|---|---|---|
| Standard | 5 | 10 | Optional | Small-to-medium environments, test labs, POCs |
| Enhanced | 10 | 20 | Optional | Medium-size production environments |
| Premium | 15 | 30 | Optional | Large, complex topologies with high-traffic workloads; recommended tier for mission-critical or production deployments |
Note: Tier downgrades are not allowed. Plan capacity ahead and upgrade only when needed.
Choosing Your Protocol
| Aspect | IPSec | WireGuard |
|---|---|---|
| Compatibility | Widely supported, works with existing VPN appliances | Modern protocol, requires control over both endpoints |
| Performance | Up to 1 Gbps | Up to 1 Gbps with lower CPU overhead |
| Setup Complexity | Configurable DH groups, multiple encryption/integrity options | Simpler configuration, faster connection setup |
| Authentication | Pre-Shared Keys (PSK) | Public-private key pairs |
| Best For | Maximum compatibility, fine-grained algorithm control | Performance-critical traffic, newer deployments |
Choose IPSec when you need maximum compatibility with existing on-premises VPN appliances or must meet compliance standards that explicitly reference IPSec.
Choose WireGuard when you prioritize performance (lower latency, higher throughput) and simplicity, have control over both ends of the tunnel, or are building new services.
What You Can Do
Secure Connectivity
Create encrypted site-to-site tunnels using IPSec or WireGuard. Choose from strong encryption algorithms including AES-128/256-CTR, GCM, CCM (IPSec) or ChaCha20 (WireGuard), with integrity verification via SHA-256/384/512 or AES-XCBC.
Multi-Site Connections
Connect on-premises data centers, office sites, or other remote locations to IONOS VDCs. All LANs attached to a single gateway must belong to the same VDC. Cross-VDC and cross-region connectivity is achieved by deploying a VPN gateway in each VDC and terminating a tunnel or peer between them, enabling distributed architectures across IONOS locations.
High Availability
Enable active-passive redundancy at the gateway level. If the primary gateway VM fails, traffic automatically fails over to the secondary instance, minimizing downtime for critical workloads.
Note: HA operates at the gateway level. Individual tunnels do not have automatic fail-over beyond what the gateway-level HA provides.
Hybrid Cloud Architecture
Extend your on-premises network securely to the cloud for hybrid deployments. This enables safe data migration, workload distribution across environments, and gradual cloud adoption strategies.
Flexible Scaling
Add or remove tunnels and peers without service interruption. Upgrade tiers as your connectivity needs grow from 5 LANs/10 tunnels up to 15 LANs/30 tunnels. Each tier increase expands your capacity to connect more LANs and establish more concurrent tunnels.
Dual-Stack Support
The gateway itself supports both IPv4 and IPv6 traffic, allowing you to route dual-stack traffic through the encrypted tunnels. Tunnel endpoints and gateway IP addresses remain IPv4-only.
Configuration Management
Download the gateway configuration (protocol-specific) for backup, troubleshooting, or manual integration with on-premises equipment. Manage gateways via the Data Center Designer (DCD) web interface, REST API, Go SDK, or Terraform provider for infrastructure-as-code automation.
Access Control
Set user privileges for VPN Gateway operations via Identity & Access Management (IAM). Control who can create, view, update, or delete gateways and their associated tunnels or peers.
Best For
| Scenario | Why It Fits |
|---|---|
| Hybrid cloud connectivity | Securely links on-premises data centers to IONOS VDCs with encrypted tunnels, no dedicated hardware required |
| Cloud migration | Protects data in transit during lift-and-shift or staged migrations from on-premises to IONOS Cloud |
| Multi-region deployments | Connects private LANs across different IONOS locations worldwide with no region constraints |
| Secure remote access | Allows employees or partners to connect from anywhere to corporate resources hosted in VDCs |
| Disaster recovery & fail-over | HA tiers provide automatic fail-over for critical workloads, guaranteeing minimal downtime |
| High-throughput data pipelines | WireGuard protocol with lower CPU overhead delivers optimal real-world throughput up to 1 Gbps per tunnel |
Consider Alternatives If
| If You Need... | Consider | Why |
|---|---|---|
| Dynamic routing (BGP) | A self-managed, BGP-capable routing VM/appliance inside the VDC, peering over the VPN tunnel | VPN Gateway supports static routing only; IONOS does not offer a managed BGP/dynamic-routing service |
| VPN endpoint directly on Managed Kubernetes LANs | Additional LAN attachment to node pools | VPN Gateway cannot connect directly to Managed Kubernetes LANs |
| Client-to-site VPN (remote users) | Third-party VPN solutions or OpenVPN deployment on Compute Engine | VPN Gateway is designed for site-to-site connections, not individual client access |
| Cross-VDC LAN connections | Separate VPN Gateway per VDC | All LANs attached to a gateway must belong to the same VDC |
Key Considerations
Billing & Costs
- Main billing: Based on tier (Standard, Enhanced, Premium), High Availability option, gateway uptime per 30 days
- When idle: Gateway continues to bill as long as it exists (based on tier and HA configuration)
- Additional costs: Egress traffic (data transfer out from VDC through the tunnels)
Limitations
- All LANs attached to a VPN Gateway must belong to the same Virtual Data Center (VDC)
- Only static routing is supported (dynamic protocols like BGP are not available)
- Gateway interface IP is not DHCP-aware (assign a static private LAN IP outside the DHCP pool, typically outside .2-.10 range)
- Tunnel endpoint and gateway IP addresses are IPv4-only (gateway can carry IPv4 + IPv6 traffic, but tunnel endpoints remain IPv4)
- Pre-Shared Keys (PSK) and WireGuard key-pairs are not auto-generated (you must provide them manually when creating tunnels/peers)
- Managed Kubernetes LANs cannot connect directly to VPN Gateways (attach additional LANs to node pools first)
- VPN Gateway must be deleted before deleting the VDC it is attached to
- Tier downgrades are not allowed (you can only upgrade tiers)
- During a scheduled 4-hour maintenance window, only name and description can be changed (all other settings locked)
Management Options
- Data Center Designer (DCD) web interface
- REST API for full lifecycle management (create, retrieve, update, delete gateways, tunnels, peers)
- Go SDK for programmatic integration
- Terraform provider for infrastructure-as-code automation
- Download configuration files (IPSec or WireGuard specific) for backup or on-premises use